What is the difference between business continuity plan and business continuity policy?

For any of you who are tasked with ensuring that your organization is ready and prepared for threats and disasters, you’ve likely done your share of online research. Two terms likely keep popping up during this research: business continuity and disaster recovery.

Depending on the resource, these two terms might be used interchangeably… If this is the case - stop reading that website, white paper, or presentation! Business continuity and disaster recovery are not the same thing. They are related and connected but they are not the same.

You need to have a business continuity plan. You need to have a disaster recovery plan. So what are they and what should you be thinking about?

Business Continuity

The Disaster Recovery Journal and Business Continuity Institute define business continuity as:

The strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level.

In practical terms this means having a plan in place that ensures your organization or company is prepared to continue business processes. This means that your people, buildings, contracts, and infrastructure can continue to operate in the event of any type of disruption.

When thinking about business continuity, it helps to think about it like this: how can I guarantee that my business will continue and that there will be continuity of service and production?

This means you need consider all aspects of your business: the people, the ways you communicate, your building(s), your technology, your third-party contracts, etc.

Disaster Recovery

The Disaster Recovery Journal and Business Continuity Institute define disaster recovery as:

The process, policies and procedures related to preparing for recovery or continuation of technology infrastructure, systems and applications which are vital to an organization after a disaster or outage.

NOTE: Disaster Recovery focuses on the information or technology systems that support business functions, as opposed to Business Continuity which involves planning for keeping all aspects of a business functioning in the midst of disruptive events. Disaster recovery is a subset of Business Continuity.

Do you see the differences here? Disaster recovery is focused on how to recover data, technology, infrastructure, systems and applications. This is necessary to ensure that business continuity can occur.

Disaster recovery planning requires you to think about how your data is stored, served, backed up and shared. You need to be confident that your employees can access the plans, files, folders, servers, email, presentations, etc. that they need from wherever they are working (an off-site office, from home, or in a coffee shop).

Putting it Together

You cannot have business continuity without disaster recovery. Disaster recovery does not guarantee business continuity. Both plans need to be in place and need to work together. Having one without the other will not ensure business success in the event of a threat or disaster. In fact, quite the opposite will likely occur.

A business continuity plan that ensures your business can continue with minimal to no interruptions requires a disaster recovery plan that ensures all data and technology is accessible and recoverable.

A business continuity plan is the bible of the organization used to continue operating during an unexpected outage or disruption. It is more thorough compared to a disaster recovery plan.

What Should a Business Continuity Plan Include?

The simple answer is that a business continuity plan should include everything that could possibly disrupt your service in case of an IT outage or a direct attack on the system infrastructure of your business. The ultimate objective is to avoid IT downtime, which costs an average of $5,600 per minute. The second element that should be included in your document is data preservation, especially sensitive information on your clients, partners, and customers.

What Is a Business Continuance Plan?

An ideal business continuance plan involves not only recovery but, more importantly, prevention. IT managers should not assume that everyone knows what to do in the aftermath of a catastrophe. The document should identify the risks and threats that could put the business in peril. Finally, the IT department should continuously test and update the plan to address new challenges.

What Should Be in a Business Continuity Plan?

The business continuance plan document should include a business impact analysis. It should also identify the personnel, processes, providers, resources, location, and applications that are mission-critical to your business. It should also incorporate prevention and mitigation measures to try to thwart or minimize the risks and threats, as well as emergency response.

What Is the Difference between a Business Continuity Plan and a Disaster Recovery Plan?

A straightforward way to differentiate the two is that business continuity is proactive while disaster recovery is reactive. As such, the business continuity plan is a more comprehensive document compared to recovery.

What Is the Difference between Business Continuity Planning and Disaster Recovery?

Disaster recovery is a series of systems and steps to get the critical process of the IT infrastructure working in the aftermath of a catastrophe. In contrast, the business continuity plan seeks to resume full functionality for the entire system, and is not only restricted to IT.

What is the difference between business continuity management and business continuity plan?

What is the difference between BC and DR?

What is another name for business continuity plan?

What should a BCP policy include?